This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Outer vlan tag removed (Windows 7)

0

Hello, When I capture VLAN-tagged packets with wireshark, I don't see VLAN tags. My OS is Windows 7 and my ethernet card is TP-LINK TG-3468 (I installed the last driver and I disabled "VLAN & priority function" in the properies in the Ethernet card driver). With Unbuntu, I can see VLAN tags with wireshark. How can I do to capture VLAN tags ?

This question is marked "community wiki".

asked 12 Nov '13, 00:28

wireshark_user's gravatar image

wireshark_user
11113
accept rate: 0%


One Answer:

0

How can I do to capture VLAN tags ?

HINT: Are you sure the VLAN tagged frames are really sent to your system? Your switch might strip them due to its own configuration.

If you are sure about the switch: I suggest to boot the system with a Linux distribution (Ubuntu, Kali Linux) from a CDROM or a USB drive and capture the VLAN tagged traffic there, as your Windows driver might not support capturing of VLAN tags, as it seems to remove them in any case, regardless of config options you chose.

Regards
Kurt

answered 14 Nov '13, 05:09

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

I'm sure there are VLAN because with Ubuntu, I can capture VLAN tags (to see my first message)

(14 Nov '13, 05:22) wireshark_user

Ah, I did not see the comment about Ubuntu.

Well, then you already have a solution, right? ;-))

If it does not work on Windows, it's (most certainly) a driver problem and there is nothing the Wireshark community can do to change that. It's rather an issue for the TP-Link support.

(14 Nov '13, 05:47) Kurt Knochner ♦